
// hook_hardcoded_address.js

console.log("--- Frida script started. Using hardcoded address to bypass API tampering. ---");

Java.perform(function() {
    console.log("[+] Java VM is ready. Now setting up native hooks with hardcoded address.");

    // ==================  你需要在这里填写从IDA获取的信息 ==================
    //
    // 1. 目标模块的名称
    const TARGET_MODULE = 'linker64'; 
    //
    // 2. 目标函数在IDA中显示的偏移地址 (Offset)
    //    请务必换成你自己在IDA里看到的真实偏移地址！
    const FUNCTION_OFFSET = 0x180f8; // 这是一个示例地址, 你必须替换它！
    //
    // ======================================================================


    let target_addr = null;

    try {
        console.log(`[i] Attempting to get base address of '${TARGET_MODULE}'...`);
        
        // 我们只依赖最基础的API来获取模块基地址
        const module_base = Module.findBaseAddress(TARGET_MODULE);
        
        if (!module_base) {
            throw new Error(`Could not find base address for ${TARGET_MODULE}. The environment is extremely hostile.`);
        }

        console.log(`[+] Found '${TARGET_MODULE}' base address at: ${module_base}`);

        // 计算函数的绝对地址: 基地址 + 偏移
        target_addr = module_base.add(FUNCTION_OFFSET);

        console.log(`[+] Calculated absolute address of target function: ${target_addr}`);
        
    } catch (e) {
        console.error(`[!!!] FAILED to calculate target address: ${e.message}`);
        console.error("[!!!] If findBaseAddress fails, the app's protection is at the highest level.");
        return;
    }
    
    // 如果成功计算出地址, 就直接Hook这个地址
    if (target_addr) {
        console.log(`[+] Attaching Interceptor directly to address ${target_addr}`);

        Interceptor.attach(target_addr, {
            onEnter: function(args) {
                try {
                    const lib_name = args[0].readCString();
                    if (lib_name) {
                       console.log(`[do_dlopen Hooked!] Loading library: ${lib_name}`);
                    }
                } catch (e) {
                    console.warn(`[!] Error reading args in hook: ${e.message}`);
                }
            },
            onLeave: function(retval) {
                // ...
            }
        });

        console.log("[+] Hook installed successfully via hardcoded address. Monitor app activity.");
    }
});